marcel/familienarchiv
1
0
Fork 0
Code Issues 105 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix(invites): deduplicate groupIds before size check in createInvite

Browse Source 
Client-submitted duplicate UUIDs were causing a false GROUP_NOT_FOUND:
size(deduplicated_db_result)==1 != size(submitted)==2. Deduplicate input
with HashSet before calling findGroupsByIds so the size comparison is
always against unique IDs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Marcel
2026-05-14 16:47:36 +02:00
parent 9230e4a531
commit d6947ce6d1
2 changed files with 19 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
backend/src/main/java/org/raddatz/familienarchiv/user/InviteService.java
View File

@@ -52,8 +52,9 @@ public class InviteService {
public InviteToken createInvite(CreateInviteRequest dto, AppUser creator) { public InviteToken createInvite(CreateInviteRequest dto, AppUser creator) {
Set<UUID> groupIds = new HashSet<>(); Set<UUID> groupIds = new HashSet<>();
if (dto.getGroupIds() != null && !dto.getGroupIds().isEmpty()) { if (dto.getGroupIds() != null && !dto.getGroupIds().isEmpty()) {
List<UserGroup> groups = userService.findGroupsByIds(dto.getGroupIds()); Set<UUID> uniqueIds = new HashSet<>(dto.getGroupIds());
if (groups.size() != dto.getGroupIds().size()) { List<UserGroup> groups = userService.findGroupsByIds(new ArrayList<>(uniqueIds));
if (groups.size() != uniqueIds.size()) {
throw DomainException.notFound(ErrorCode.GROUP_NOT_FOUND, "One or more group IDs do not exist"); throw DomainException.notFound(ErrorCode.GROUP_NOT_FOUND, "One or more group IDs do not exist");
} }
groups.forEach(g -> groupIds.add(g.getId())); groups.forEach(g -> groupIds.add(g.getId()));

17
backend/src/test/java/org/raddatz/familienarchiv/user/InviteServiceTest.java
View File

@@ -159,7 +159,7 @@ class InviteServiceTest {
@Test @Test
void createInvite_throwsGroupNotFound_whenSubmittedGroupIdDoesNotExist() { void createInvite_throwsGroupNotFound_whenSubmittedGroupIdDoesNotExist() {
UUID unknownGroupId = UUID.randomUUID(); UUID unknownGroupId = UUID.randomUUID();
when(userService.findGroupsByIds(List.of(unknownGroupId))).thenReturn(List.of()); when(userService.findGroupsByIds(anyList())).thenReturn(List.of());
CreateInviteRequest req = new CreateInviteRequest(); CreateInviteRequest req = new CreateInviteRequest();
req.setGroupIds(List.of(unknownGroupId)); req.setGroupIds(List.of(unknownGroupId));
@@ -170,6 +170,21 @@ class InviteServiceTest {
.isEqualTo(ErrorCode.GROUP_NOT_FOUND); .isEqualTo(ErrorCode.GROUP_NOT_FOUND);
} }
@Test
void createInvite_doesNotThrowGroupNotFound_whenDuplicateGroupIdsSubmitted() {
UUID groupId = UUID.randomUUID();
UserGroup group = UserGroup.builder().id(groupId).name("Familie").build();
when(inviteTokenRepository.findByCode(anyString())).thenReturn(Optional.empty());
when(userService.findGroupsByIds(anyList())).thenReturn(List.of(group));
when(inviteTokenRepository.save(any())).thenAnswer(inv -> inv.getArgument(0));
CreateInviteRequest req = new CreateInviteRequest();
req.setGroupIds(List.of(groupId, groupId)); // same UUID submitted twice
// before deduplication: size(groups)==1 != size(submitted)==2 → false GROUP_NOT_FOUND
assertThatCode(() -> inviteService.createInvite(req, admin)).doesNotThrowAnyException();
}
// ─── redeemInvite ───────────────────────────────────────────────────────── // ─── redeemInvite ─────────────────────────────────────────────────────────
@Test @Test